Security architecture
Authorized, encrypted, visible, and locally stoppable.
Verified-email access, optional standard-user MFA, mandatory admin MFA, device keys, exact participants, short leases, and explicit grants constrain each session.
From account proof to authenticated transport
- 01
Verify the account and admin step-up
Standard users use a verified-email magic link and may add passkey or TOTP. Every admin must provide a recent passkey or live TOTP; recovery alone cannot authorize admin access or actions.
- 02
Enroll a device key
The device generates a non-exportable P-256 key and uploads only its public identity and bounded metadata.
- 03
Authorize exact participants
The request names viewer and host. The host accepts each viewer and selects permissions locally.
- 04
Bind and renew narrowly
A one-use ticket binds peer fingerprints while short leases require continuing account authority.
Control plane
Identity and authorization
Accounts, verified-email sessions, optional passkey and TOTP records, mandatory admin step-up, device public keys, entitlements, session requests, leases, bounded signaling, and content-free audit metadata.
Endpoint data plane
Session content and private keys
Private keys, screen, input, clipboard, files, and session key material remain encrypted between participating endpoints.
Security boundaries
- No stealth installation, capture, or input.
- No keylogging, remote shell, general VPN, arbitrary proxy, or unrestricted port forwarding.
- No browser or operating-system permission bypass.
- No administrator function for watching or decrypting customer sessions.
- No session-content storage in the control service or TURN relay.
- No automatic connection merely because devices share an account.
Report security issues directly
Include the affected origin, the browser and desktop app versions, a minimal reproduction, and a timestamp. Remove tokens, keys, and session content before sending.
security@reallexi.io